4 ms·

Tell HN: Coca-Cola staging servers are showing up in search results

19 points by cryptoz 2y ago

See for example, https://www.google.com/search?q=cherry+coke gives you a top result of https://staging.us.coca-cola.com/products/coca-cola-energy/cherry which prompts with like an htaccess password

doormatt 2y ago
Top result for me is https://en.wikipedia.org/wiki/Coca-Cola_Cherry https://en.wikipedia.org/wiki/Coca-Cola_Cherry
- cryptoz 2y ago
  ok, sorry, second result.
  - doormatt 2y ago
    Second link: https://www.realcanadiansuperstore.ca/cherry-flavoured-cola/p/21392782_C12 https://www.realcanadiansuperstore.ca/cherry-flavoured-cola/... Third link: https://www.coca-cola.com/ca/en/brands/coca-cola/products/coca-cola-cherry https://www.coca-cola.com/ca/en/brands/coca-cola/products/co... Fourth link: https://jillianharris.com/just-in-time-for-summer-the-best-cherry-cola-recipe/ https://jillianharris.com/just-in-time-for-summer-the-best-c...
    - cryptoz 2y ago
      Okay so the US link isn’t showing up for you in Canada, sure, but it does happen in the US.
mikequinlan 2y ago
So what is the username and password?
- cryptoz 2y ago
  I did try a few things but didn’t get in haha
  - Jugurtha 2y ago
    The luxury to write this in jest... You have no idea.
ipaddr 2y ago
The footer has a 2021 copyright.
daemonologist 2y ago
Yep I see it, though it doesn't prompt me for a password - just looks like a normal half-finished website (although very different from www.coca-cola.com). Interesting.
GauntletWizard 2y ago
I see it, but I don't see a password; It looks just like the live site to me. https://imgur.com/a/Zn9tHCk https://imgur.com/a/Zn9tHCk
Raed667 2y ago
> Coca-Cola® Energy Zero Sugar > Calories 0 > Coca-Cola® Energy Zero Sugar combines the great taste of Coca-Cola with the energy you want to power you
- Our_Benefactors 2y ago
  Still has caffeine. Also no zero calorie soda is truly zero cal. They take advantage of labeling laws and serving sizes to be able to put “0 calories” even on gigantic 2 liter bottles.
lbhdc 2y ago
I got a different staging server as my #2 result. This is password pretected like OP suggested. https://preview.us.coca-cola.com/products/coca-cola-flavors/cherry-vanilla https://preview.us.coca-cola.com/products/coca-cola-flavors/... The link OP shared is open to the public to me. https://staging.us.coca-cola.com/products/coca-cola-energy/cherry https://staging.us.coca-cola.com/products/coca-cola-energy/c... I would think that even if these weren't showing up on google that people would be able to find the subdomains through dns. They should probably move these to an internal domain so they are harder to find.
uaas 2y ago
This applies to most big companies, maybe you just happened to notice it now. Security researchers are leveraging these (called Google dorks) every minute to find targets.
denysvitali 2y ago
For me the same happens w/ Netflix: their staging environment just shows up in normal search results: https://www.release.staging.ssic.netflix.com/ https://www.release.staging.ssic.netflix.com/

19 points by cryptoz 2y ago

See for example, https://www.google.com/search?q=cherry+coke gives you a top result of https://staging.us.coca-cola.com/products/coca-cola-energy/cherry which prompts with like an htaccess password

doormatt 2y ago

Top result for me is https://en.wikipedia.org/wiki/Coca-Cola_Cherry https://en.wikipedia.org/wiki/Coca-Cola_Cherry

cryptoz 2y ago
ok, sorry, second result.
- doormatt 2y ago
  Second link: https://www.realcanadiansuperstore.ca/cherry-flavoured-cola/p/21392782_C12 https://www.realcanadiansuperstore.ca/cherry-flavoured-cola/... Third link: https://www.coca-cola.com/ca/en/brands/coca-cola/products/coca-cola-cherry https://www.coca-cola.com/ca/en/brands/coca-cola/products/co... Fourth link: https://jillianharris.com/just-in-time-for-summer-the-best-cherry-cola-recipe/ https://jillianharris.com/just-in-time-for-summer-the-best-c...
  - cryptoz 2y ago
    Okay so the US link isn’t showing up for you in Canada, sure, but it does happen in the US.

mikequinlan 2y ago

So what is the username and password?

cryptoz 2y ago
I did try a few things but didn’t get in haha
- Jugurtha 2y ago
  The luxury to write this in jest... You have no idea.

ipaddr 2y ago

The footer has a 2021 copyright.

daemonologist 2y ago

Yep I see it, though it doesn't prompt me for a password - just looks like a normal half-finished website (although very different from www.coca-cola.com). Interesting.

GauntletWizard 2y ago

I see it, but I don't see a password; It looks just like the live site to me. https://imgur.com/a/Zn9tHCk https://imgur.com/a/Zn9tHCk

Raed667 2y ago

> Coca-Cola® Energy Zero Sugar > Calories 0 > Coca-Cola® Energy Zero Sugar combines the great taste of Coca-Cola with the energy you want to power you

Our_Benefactors 2y ago
Still has caffeine. Also no zero calorie soda is truly zero cal. They take advantage of labeling laws and serving sizes to be able to put “0 calories” even on gigantic 2 liter bottles.

lbhdc 2y ago

I got a different staging server as my #2 result. This is password pretected like OP suggested. https://preview.us.coca-cola.com/products/coca-cola-flavors/cherry-vanilla https://preview.us.coca-cola.com/products/coca-cola-flavors/... The link OP shared is open to the public to me. https://staging.us.coca-cola.com/products/coca-cola-energy/cherry https://staging.us.coca-cola.com/products/coca-cola-energy/c... I would think that even if these weren't showing up on google that people would be able to find the subdomains through dns. They should probably move these to an internal domain so they are harder to find.

uaas 2y ago

This applies to most big companies, maybe you just happened to notice it now. Security researchers are leveraging these (called Google dorks) every minute to find targets.

denysvitali 2y ago

For me the same happens w/ Netflix: their staging environment just shows up in normal search results: https://www.release.staging.ssic.netflix.com/ https://www.release.staging.ssic.netflix.com/